Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Slow DNS after 22.05

    Scheduled Pinned Locked Moved DHCP and DNS
    270 Posts 31 Posters 138.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      vaidas
      last edited by vaidas

      I am too having problems after 22.05 upgrade with dns resolves timing out completely
      unbound logs does not show any problems.
      config haven't changed from 22.01 where dns worked perfectly.
      running bare metal
      plugins: openvpn client export, nut service for ups, watchdog that's it.

      lohphatL 1 Reply Last reply Reply Quote 2
      • J
        Jax
        last edited by

        @bmeeks I took your suggestion and this morning things seem to be working better.
        We'll see how things go on later in the day, thanks for your help.

        J 1 Reply Last reply Reply Quote 0
        • J
          Jax @Jax
          last edited by

          @bmeeks of course this very much suggests pfSense DNS is indeed the problem.

          bmeeksB 1 Reply Last reply Reply Quote 0
          • bmeeksB
            bmeeks @Jax
            last edited by

            @jax said in Slow DNS after 22.05:

            @bmeeks of course this very much suggests pfSense DNS is indeed the problem.

            But it's not a widespread problem or the forum here would be overflowing with posts about it. There are only a few. Not saying there can't be a problem, but it's not affecting everyone it seems.

            It's entirely possible your virtualization environment could be at fault here as well. There could be an issue with the latest pfSense (FreeBSD) version and Proxmox.

            J 1 Reply Last reply Reply Quote 0
            • J
              Jax @bmeeks
              last edited by

              @bmeeks Thanks again for your help.

              I'm on a Netgate device that I purchased with pfSense already installed so no virtualization issues that would be unique to my setup. I have made no software modifications. There are many variables here:

              • pfSense DNS
              • pfSense DHCP interacting with desktop operating system
              • pfSense DNS interacting with service provider premises devices

              ... and so forth.

              In any case, the setup has been working for about 18 months for me, I personally made no changes and the problem seemed to emerge with pfSense 22.05. However, Correlation ≠ Causation as we all have been taught 🙄 So I suppose I will have to continue to gather clues and see what I can figure out over time 🤕 .

              bmeeksB 1 Reply Last reply Reply Quote 0
              • lohphatL
                lohphat @vaidas
                last edited by lohphat

                @vaidas I've come to report the same thing.

                I thought it was PfBlockerNG-devel but even with that off I'm seeing CDN content fail (e.g. YouTube). If I bypass unbound by using a client VPN, no problems.

                Seeing a lot of timeout and "domain not found" and have to manually reload pages to get them to load.

                No changes were made to the unbound settings between 22.01 and 22.05.

                SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                J 1 Reply Last reply Reply Quote 0
                • J
                  Jax @lohphat
                  last edited by Jax

                  @lohphat Yes, I'm seeing the same thing, that the problem seems to be mostly with cdn site resolution.

                  1 Reply Last reply Reply Quote 0
                  • bmeeksB
                    bmeeks @Jax
                    last edited by bmeeks

                    @jax said in Slow DNS after 22.05:

                    @bmeeks Thanks again for your help.

                    I'm on a Netgate device that I purchased with pfSense already installed so no virtualization issues that would be unique to my setup.

                    Sorry, I confused your post with another at the top of this thread where the OP said they were running on Proxmox.

                    I see where you said you were running on an SG-2100. That is an ARM-based appliance (not Intel). Another poster in this thread has an SG-3100 in his signature. That is also an ARM-based appliance. Could be an issue with the latest unbound version and ARM hardware. I did notice that when my SG-5100 updated it pulled down a new unbound version as part of the upgrade. I've not seen any issue on my SG-5100, but it is Intel-based hardware.

                    There have, in the past, been some weird issues with software running on ARM hardware due in part to some quirkiness with the llvm compiler used.

                    J 1 Reply Last reply Reply Quote 1
                    • J
                      Jax @bmeeks
                      last edited by

                      @bmeeks Thanks again for clarifying ... @rcoleman-netgate do you have any further observations on this issue? It does seem to be Netgate-specific.

                      1 Reply Last reply Reply Quote 0
                      • D
                        domnado
                        last edited by

                        I had to put in a support ticket because I wasn't able to boot my device after trying to rollback to 22.01. While in my support ticket for getting the firmware to reflash I was told about an IP monitoring option "System->Routing->Gateways" edit ipv4 Gateway and to change "Monitor IP" to a public DNS server because the system pings this IP on a consistent basis and some ISPs treat this as a DoS attack and will temporarily block it, then the router will consider the WAN connection down. After using a Google, Cloudflare or OpenDNS server IP address in this field I have not had any issues with unbound on my SG 1100.

                        1 Reply Last reply Reply Quote 0
                        • lohphatL
                          lohphat
                          last edited by lohphat

                          Datapoint:

                          I had DNSSEC enabled in 22.01 and the setting carried over into 22.05 when I upgraded this morning.

                          After playing with different configs all day, turning off DNSSEC seems to have made things stable for me. I'll keep playing with it.

                          8jul2022 Update: Nope, it was better after startup but started misbehaving anyway after an hour.

                          9jul2022 Update: The stable config for me is to disable local DNS resolution and just forward it to the upstream DNS providers. DNSSEC is enabled. I've just added pfBlockerNG-devel into the mix and will see how things work over the day.

                          9jul2022 Update 2: Had to disable pfBlockerNG-devel due to inability to resolve domains. Just running on unbound only, no filtering.

                          SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                          1 Reply Last reply Reply Quote 0
                          • lohphatL
                            lohphat
                            last edited by

                            I'm getting a lot of these in the DNS Resolver log with pfBlockerNG-devel uninstalled, DNS forwarding and DNSSEC enabled:

                            Jul 9 12:43:02 	filterdns 	82159 	failed to resolve host steamusercontent.com will retry later again.
                            Jul 9 12:43:02 	filterdns 	82159 	failed to resolve host steamstatic.com will retry later again.
                            Jul 9 12:43:02 	filterdns 	82159 	failed to resolve host steamcontent.com will retry later again.
                            

                            SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                            johnpozJ GertjanG 2 Replies Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @lohphat
                              last edited by johnpoz

                              @lohphat said in Slow DNS after 22.05:

                              DNS forwarding and DNSSEC enabled:

                              That is never a good idea, if your going to forward where you forward either does dnssec or it doesn't you asking for it does nothing - other than problematic.

                              If you forward, uncheck use dnssec in the unbound settings.

                              example, 8.8.8.8 does dnssec be it you ask it to or not

                              $ dig @8.8.8.8 www.dnssec-failed.org
                              
                              ; <<>> DiG 9.16.30 <<>> @8.8.8.8 www.dnssec-failed.org
                              ; (1 server found)
                              ;; global options: +cmd
                              ;; Got answer:
                              ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 13556
                              ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
                              
                              ;; OPT PSEUDOSECTION:
                              ; EDNS: version: 0, flags:; udp: 512
                              ;; QUESTION SECTION:
                              ;www.dnssec-failed.org.         IN      A
                              
                              ;; Query time: 83 msec
                              ;; SERVER: 8.8.8.8#53(8.8.8.8)
                              ;; WHEN: Sat Jul 09 13:05:11 Central Daylight Time 2022
                              ;; MSG SIZE  rcvd: 50
                              

                              see how that fails - while if I ask 4.2.2.2 it does not

                              $ dig @4.2.2.2 www.dnssec-failed.org
                              
                              ; <<>> DiG 9.16.30 <<>> @4.2.2.2 www.dnssec-failed.org
                              ; (1 server found)
                              ;; global options: +cmd
                              ;; Got answer:
                              ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25984
                              ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
                              
                              ;; OPT PSEUDOSECTION:
                              ; EDNS: version: 0, flags:; udp: 8192
                              ;; QUESTION SECTION:
                              ;www.dnssec-failed.org.         IN      A
                              
                              ;; ANSWER SECTION:
                              www.dnssec-failed.org.  7200    IN      A       68.87.109.242
                              www.dnssec-failed.org.  7200    IN      A       69.252.193.191
                              
                              ;; Query time: 191 msec
                              ;; SERVER: 4.2.2.2#53(4.2.2.2)
                              ;; WHEN: Sat Jul 09 13:05:24 Central Daylight Time 2022
                              ;; MSG SIZE  rcvd: 82
                              

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              lohphatL 2 Replies Last reply Reply Quote 0
                              • lohphatL
                                lohphat @johnpoz
                                last edited by

                                @johnpoz Yes, I know, but I'm forwarding to the 9.9.9.9 group of servers and they claim to support DNSSEC.

                                https://quad9.net/support/faq/#dnssec

                                SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @lohphat
                                  last edited by

                                  @lohphat said in Slow DNS after 22.05:

                                  9.9.9.9 group of servers and they claim to support DNSSEC.

                                  There is no need to ask for dnssec - they are doing it be it you ask them or not..

                                  $ dig @9.9.9.9 www.dnssec-failed.org
                                  
                                  ; <<>> DiG 9.16.30 <<>> @9.9.9.9 www.dnssec-failed.org
                                  ; (1 server found)
                                  ;; global options: +cmd
                                  ;; Got answer:
                                  ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 1538
                                  ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
                                  
                                  ;; OPT PSEUDOSECTION:
                                  ; EDNS: version: 0, flags:; udp: 512
                                  ; EDE: 9 (DNSKEY Missing)
                                  ;; QUESTION SECTION:
                                  ;www.dnssec-failed.org.         IN      A
                                  
                                  ;; Query time: 72 msec
                                  ;; SERVER: 9.9.9.9#53(9.9.9.9)
                                  ;; WHEN: Sat Jul 09 13:10:14 Central Daylight Time 2022
                                  ;; MSG SIZE  rcvd: 56
                                  

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  lohphatL 1 Reply Last reply Reply Quote 0
                                  • lohphatL
                                    lohphat @johnpoz
                                    last edited by

                                    @johnpoz Ok, Done. The option needs a better info text as it is it seems to imply that it needs to be on to support any DNSSEC at all.

                                    SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @lohphat
                                      last edited by

                                      @lohphat I would agree with you, should really have a note under it - If your going to forward do not set this or something like that.

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • lohphatL
                                        lohphat
                                        last edited by lohphat

                                        Still getting filterdns errors with DNSSEC unchecked:

                                        Jul 9 15:23:01 	filterdns 	82159 	failed to resolve host steamstatic.com will retry later again.
                                        Jul 9 15:23:01 	filterdns 	82159 	failed to resolve host steamcontent.com will retry later again.
                                        Jul 9 15:23:01 	filterdns 	82159 	failed to resolve host steamusercontent.com will retry later again.
                                        Jul 9 15:18:01 	filterdns 	82159 	failed to resolve host steamstatic.com will retry later again.
                                        Jul 9 15:18:01 	filterdns 	82159 	failed to resolve host steamcontent.com will retry later again.
                                        

                                        SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @lohphat
                                          last edited by

                                          @lohphat thats not a unbound problem

                                          ;; QUESTION SECTION:                                                                                                     
                                          ;steamstatic.com.               IN      A                                                                                
                                                                                                                                                                   
                                          ;; AUTHORITY SECTION:                                                                                                    
                                          steamstatic.com.        1344    IN      SOA     ns1.valvesoftware.com. admin.valvesoftware.com. 2022041804 3600 900 24192
                                          00 3600                                                                                                                  
                                                                                                                                                                   
                                          ;; Query time: 84 msec                                                                                                   
                                          ;; SERVER: 9.9.9.9#53(9.9.9.9)                                                                                           
                                          ;; WHEN: Sat Jul 09 14:31:06 Central Daylight Time 2022                                                                  
                                          ;; MSG SIZE  rcvd: 104
                                          
                                          $ dig @9.9.9.9 steamusercontent.com                                                                                      
                                                                                                                                                                   
                                          ; <<>> DiG 9.16.30 <<>> @9.9.9.9 steamusercontent.com                                                                    
                                          ; (1 server found)                                                                                                       
                                          ;; global options: +cmd                                                                                                  
                                          ;; Got answer:                                                                                                           
                                          ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47670                                                                
                                          ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1                                                     
                                                                                                                                                                   
                                          ;; OPT PSEUDOSECTION:                                                                                                    
                                          ; EDNS: version: 0, flags:; udp: 1232                                                                                    
                                          ;; QUESTION SECTION:                                                                                                     
                                          ;steamusercontent.com.          IN      A                                                                                
                                                                                                                                                                   
                                          ;; AUTHORITY SECTION:                                                                                                    
                                          steamusercontent.com.   3600    IN      SOA     ns1.valvesoftware.com. admin.valvesoftware.com. 2022010300 3600 900 24192
                                          00 3600                                                                                                                  
                                                                                                                                                                   
                                          ;; Query time: 68 msec                                                                                                   
                                          ;; SERVER: 9.9.9.9#53(9.9.9.9)                                                                                           
                                          ;; WHEN: Sat Jul 09 14:32:16 Central Daylight Time 2022                                                                  
                                          ;; MSG SIZE  rcvd: 109                                                                                                   
                                          

                                          I get same results trying to just resolve.. they seem to be having an issue.. Or that isn't meant to resolve in the first place.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          lohphatL 1 Reply Last reply Reply Quote 1
                                          • lohphatL
                                            lohphat @johnpoz
                                            last edited by

                                            @johnpoz said in Slow DNS after 22.05:

                                            thats not a unbound problem

                                            I get same results trying to just resolve.. they seem to be having an issue.. Or that isn't meant to resolve in the first place.

                                            What's even stranger, is that the steam.exe client isn't running and it's still throwing the DNS errors hours after the client exited.

                                            I'm still getting occasional failed lookups where I have to force reload a page for the domain to resolve.

                                            Something is still broken.

                                            SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                                            johnpozJ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.